CVE-2019-10327 - An XML external entities (XXE) vulnerability in Jenkins Pipeline Maven Integration Plugin 1.7.0 and earlier allowed attackers able to control a temporary directory's content on the agent running the Maven build to have Jenkins parse a maliciously crafted XML file that uses external entities for extraction of secrets from the Jenkins master, server-side request forgery, or denial-of-service attacks

Back Back to CVE browser

HIGH

An XML external entities (XXE) vulnerability in Jenkins Pipeline Maven Integration Plugin 1.7.0 and earlier allowed attackers able to control a temporary directory's content on the agent running the Maven build to have Jenkins parse a maliciously crafted XML file that uses external entities for extraction of secrets from the Jenkins master, server-side request forgery, or denial-of-service attacks

Published May 31, 2019

8.1

HIGH

CVSS 3.0

EPSS 1.44%

Description

An XML external entities (XXE) vulnerability in Jenkins Pipeline Maven Integration Plugin 1.7.0 and earlier allowed attackers able to control a temporary directory's content on the agent running the Maven build to have Jenkins parse a maliciously crafted XML file that uses external entities for extraction of secrets from the Jenkins master, server-side request forgery, or denial-of-service attacks.

Affected products

Vendor Jenkins project Product Jenkins Pipeline Maven Integration Plugin Default
n/a
- Version
  1.7.0 and earlier
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Jenkins project

Jenkins Pipeline Maven Integration Plugin

n/a

Version	Status	Constraints
1.7.0 and earlier	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-611

XXE

References (6)

http://www.openwall.com/lists/oss-security/2019/05/31/2
mailing-listx_refsource_MLIST
http://www.securityfocus.com/bid/108540
vdb-entryx_refsource_BID
https://github.com/advisories/GHSA-6755-jgp4-8q7h
Advisory
https://github.com/jenkinsci/pipeline-maven-plugin/commit/e7cb858852c05d2423e3fd9922a090982dcd6392
https://jenkins.io/security/advisory/2019-05-31/#SECURITY-1409
x_refsource_CONFIRMVendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2019-10327

Link	Providers	Tags
http://www.openwall.com/lists/oss-security/2019/05/31/2		mailing-listx_refsource_MLIST
http://www.securityfocus.com/bid/108540		vdb-entryx_refsource_BID
https://github.com/advisories/GHSA-6755-jgp4-8q7h		Advisory
https://github.com/jenkinsci/pipeline-maven-plugin/commit/e7cb858852c05d2423e3fd9922a090982dcd6392
https://jenkins.io/security/advisory/2019-05-31/#SECURITY-1409		x_refsource_CONFIRMVendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2019-10327